refactor(web): replace Auth.js with stateless Better Auth #106

Merged

eleith merged 1 commits from refactor/better-auth into main 2026-10-30 01:06:49 +00:00

Conversation 0 Commits 1 Files Changed 23

+936 -340

eleith-gitea-agent Bot commented 2026-10-29 23:40:06 +00:00

Copy link

Copy source

Summary

• Replace Auth.js with Better Auth 1.7.14 using the existing YAML credentials or OIDC configuration. Native handler/client, CSRF protection and in-memory rate limiting; no auth database or direct Zod dependency.
• Keep the sign-in/admin UI, OIDC callback and local-only logout. Use provider-specific hooks, safe return paths, canonical-URL reload handling, and a button busy state that lasts through redirect handoff.
• Fixed seven-day encrypted sessions; existing Auth.js cookies require signing in again. Trust Nginx's X-Real-IP through the library option, without custom request headers or rewriting.
• Include focused handler/config/redirect regressions and update existing browser checks without adding an IdP harness. SvelteKit 3 and operator-doc changes are outside this PR.

Validation

• Final independent code/security and readability reviews clear; trailing-slash public URL regression fixed and covered before publication.
• 2,315 workspace tests passed with coverage, including 1,072 web tests; all 67 browser tests passed on a fresh isolated production web build.
• Shared-package, worker and CLI builds, web type checking/lint, changeset formatting and diff checks passed.
• Owner manually confirmed successful sign-in and the corrected busy transition. No independent agent-run live Authelia/provider compatibility exercise; remote CI is separate.

Deployment notes

• Nginx must overwrite X-Real-IP and the app must not be publicly reachable around it. Limiter counters are per-process memory, not distributed protection.
• No YAML/schema/database migration. Operator docs are deliberately unchanged as requested; existing Auth.js/no-password-limiting wording is stale.

## Summary - Replace Auth.js with Better Auth 1.7.14 using the existing YAML credentials or OIDC configuration. Native handler/client, CSRF protection and in-memory rate limiting; no auth database or direct Zod dependency. - Keep the sign-in/admin UI, OIDC callback and local-only logout. Use provider-specific hooks, safe return paths, canonical-URL reload handling, and a button busy state that lasts through redirect handoff. - Fixed seven-day encrypted sessions; existing Auth.js cookies require signing in again. Trust Nginx's X-Real-IP through the library option, without custom request headers or rewriting. - Include focused handler/config/redirect regressions and update existing browser checks without adding an IdP harness. SvelteKit 3 and operator-doc changes are outside this PR. ## Validation - Final independent code/security and readability reviews clear; trailing-slash public URL regression fixed and covered before publication. - 2,315 workspace tests passed with coverage, including 1,072 web tests; all 67 browser tests passed on a fresh isolated production web build. - Shared-package, worker and CLI builds, web type checking/lint, changeset formatting and diff checks passed. - Owner manually confirmed successful sign-in and the corrected busy transition. No independent agent-run live Authelia/provider compatibility exercise; remote CI is separate. ## Deployment notes - Nginx must overwrite X-Real-IP and the app must not be publicly reachable around it. Limiter counters are per-process memory, not distributed protection. - No YAML/schema/database migration. Operator docs are deliberately unchanged as requested; existing Auth.js/no-password-limiting wording is stale.

eleith-gitea-agent Bot added 1 commit 2026-10-29 23:40:06 +00:00

refactor(web): replace Auth.js with stateless Better Auth 7802f134c1

eleith merged commit 7802f134c1 into main 2026-10-30 01:06:49 +00:00

eleith deleted branch refactor/better-auth 2026-10-30 01:06:49 +00:00

eleith-gitea-agent Bot referenced this pull request 2026-10-30 01:10:56 +00:00

Upgrade to SvelteKit 3 #66

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

blocked

Waiting on a prerequisite before work can proceed

bug

Something is not working

enhancement

New feature

No labels

Milestone

No items

No Milestone

Assignees

Clear assignees

eleith-gitea-agent Bot eleith (eleith)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: eleith/when#106